It is more faster and easier to pass the EC-Council 312-50 exam by using Practical EC-Council Ethical Hacking and Countermeasures (CEHv6) questuins and answers. Immediate access to the Improved 312-50 Exam and find the same core area 312-50 questions with professionally verified answers, then PASS your exam with a high score now.

2021 Mar 312-50 free practice questions

Q211. What is the best means of prevention against viruses? 

A. Assign read only permission to all files on your system. 

B. Remove any external devices such as floppy and USB connectors. 

C. Install a rootkit detection tool. 

D. Install and update anti-virus scanner. 

Answer: D

Explanation: Although virus scanners only can find already known viruses this is still the best defense, together with users that are informed about risks with the internet. 


Q212. What are the different between SSL and S-HTTP? 

A. SSL operates at the network layer and S-HTTP operates at the application layer 

B. SSL operates at the application layer and S-HTTP operates at the network layer 

C. SSL operates at transport layer and S-HTTP operates at the application layer 

D. SSL operates at the application layer and S-HTTP operates at the transport layer 

Answer: C

Explanation: Whereas SSL is designed to establish a secure connection between two computers, S-HTTP is designed to send individual messages securely. S-HTTP is defined in RFC 2660 


Q213. Which of the following is not an effective countermeasure against replay attacks? 

A. Digital signatures 

B. Time Stamps 

C. System identification 

D. Sequence numbers 

Answer: C

Explanation: A replay attack is a form of network attack in which a valid data transmission is maliciously or fraudulently repeated or delayed. Effective countermeasures should be anything that makes it hard to delay or replay the packet (time stamps and sequence numbers) or anything that prove the package is received as it was sent from the original sender (digital signature) 


Q214. Blane is a network security analyst for his company. From an outside IP, Blane performs an XMAS scan using Nmap. Almost every port scanned does not illicit a response. What can he infer from this kind of response? 

A. These ports are open because they do not illicit a response. 

B. He can tell that these ports are in stealth mode. 

C. If a port does not respond to an XMAS scan using NMAP, that port is closed. 

D. The scan was not performed correctly using NMAP since all ports, no matter what their state, will illicit some sort of response from an XMAS scan. 

Answer: A


Q215. You are conducting an idlescan manually using HPING2. During the scanning process, you notice that almost every query increments the IPID- regardless of the port being queried. One or two of the queries cause the IPID to increment by more than one value. Which of he following options would be a possible reason? 

A. Hping2 can’t be used for idlescanning 

B. The Zombie you are using is not truly idle 

C. These ports are actually open on the target system 

D. A stateful inspection firewall is resetting your queries 

Answer: B

Explanation: If the IPID increments more than one value that means that there has been network traffic between the queries so the zombie is not idle. 


Most up-to-date 312-50 free exam:

Q216. Dave has been assigned to test the network security of Acme Corp. The test was announced to the employees. He created a webpage to discuss the progress of the tests with employees who were interested in following the test. Visitors were allowed to click on a sand clock to mark the progress of the test. Dave successfully embeds a keylogger. He also added some statistics on the webpage. The firewall protects the network well and allows strict Internet access. How was security compromised and how did the firewall respond? 

A. The attack did not fall through as the firewall blocked the traffic 

B. The attack was social engineering and the firewall did not detect it 

C. The attack was deception and security was not directly compromised 

D. Security was not compromised as the webpage was hosted internally 

Answer: B

Explanation: This was just another way to trick the information out of the users without the need to hack into any systems. All traffic is outgoing and initiated by the user so the firewall will not react. 


Q217. Hackers usually control Bots through: 

A. IRC Channel 

B. MSN Messenger 

C. Trojan Client Software 

D. Yahoo Chat 

E. GoogleTalk 

Answer: A

Explanation: Most of the bots out today has a function to connect to a predetermined IRC channel in order to get orders. 


Q218. When referring to the Domain Name Service, what is denoted by a ‘zone’? 

A. It is the first domain that belongs to a company. 

B. It is a collection of resource records. 

C. It is the first resource record type in the SOA. 

D. It is a collection of domains. 

Answer: B

Explanation: A reasonable definition of a zone would be a portion of the DNS namespace where responsibility has been delegated. 


Q219. An attacker runs netcat tool to transfer a secret file between two hosts. 

Machine A: netcat -1 –p 1234 < secretfile Machine B: netcat 192.168.3.4 > 1234 

He is worried about information being sniffed on the network. 

How would the attacker use netcat to encrypt information before transmitting it on the wire? 

A. Machine A: netcat -1 –p –s password 1234 < testfile Machine B: netcat <machine A IP> 1234 

B. Machine A: netcat -1 –e magickey –p 1234 < testfile Machine B: netcat <machine A IP> 1234 

C. Machine A: netcat -1 –p 1234 < testfile –pw password Machine B: netcat <machine A IP> 1234 –pw password 

D. Use cryptcat instead of netcat. 

Answer: D

Explanation: Cryptcat is the standard netcat enhanced with twofish encryption with ports for WIndows NT, BSD and Linux. Twofish is courtesy of counterpane, and cryptix. A default netcat installation does not contain any cryptography support. 


Q220. One of the ways to map a targeted network for live hosts is by sending an ICMP ECHO request to the broadcast or the network address. The request would be broadcasted to all hosts on the targeted network. The live hosts will send an ICMP ECHO Reply to the attacker source IP address. 

You send a ping request to the broadcast address 192.168.5.255. 

[root@ceh/root]# ping -b 192.168.5.255 WARNING: pinging broadcast address PING 192.168.5.255 (192.168.5.255) from 192.168.5.1 : 56(84) bytes of data. 64 bytes from 192.168.5.1: icmp_seq=0 ttl=255 time=4.1 ms 64 bytes from 192.168.5.5: icmp_seq=0 ttl=255 time=5.7 ms 

There are 40 computers up and running on the target network. Only 13 hosts send a reply while others do not. Why? 

A. You cannot ping a broadcast address. The above scenario is wrong. 

B. You should send a ping request with this command ping 192.168.5.0-255 

C. Linux machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO request aimed at the broadcast address or at the network address. 

D. Windows machines will not generate an answer (ICMP ECHO Reply) to an ICMP ECHO request aimed at the broadcast address or at the network address. 

Answer: D

Explanation: As stated in the correct option, Microsoft Windows does not handle pings to a broadcast address correctly and therefore ignores them.